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REMARKS 

This Application has been carefully reviewed in light of the Office Action dated 
October 22, 2008 (the "Office Action"). Applicants previously canceled Claims 2-3, 5-7, and 
17-19 without prejudice or disclaimer. Applicants respectfully request reconsideration and 
favorable action in this case. 

Section 103 Rejections 

Claims 1, 4, 8-16, 20, 22 and 23 are rejected under 35 U.S.C. § 103(a) as being 
unpatentable over U.S. Patent No. 6,192,512 issued to Chess ("Chess") in view of U.S. Patent 
No. 5,851,057 issued to Nachenberg ("Nachenberg"). Applicants respectfully traverse this 
rejection. 

Claim 1 recites: 

A method of detecting viral code in subject files, comprising: 
creating an artificial memory region spanning one or more components 

of the operating system, wherein the artificial memory region is associated 

with an export table of a dynamically-linked library; 

emulating execution of at least a portion of computer executable code 

in a subject file; 

monitoring attempts by the emulated computer executable code to 
access the artificial memory region; 

in response to detecting an attempt to access the artificial memory 
region, determining an export table entry in the export table of the 
dynamically-linked library that is associated with the attempt to access the 
artificial memory region; and 

determining based on the export table entry associated with the attempt 
to access the artificial memory region that the emulated computer executable 
code is viral. 

The proposed Chess-Nachenberg combination fails to disclose, teach, or suggest 
every element of Claim 1 for at least several reasons. First, the proposed Chess-Nachenberg 
combination fails to disclose "creating an artificial memory region spanning one or more 
components of the operating system, wherein the artificial memory region is associated with 
an export table of a dynamically-linked library." Second, the proposed Chess-Nachenberg 
combination fails to disclose "in response to detecting an attempt to access the artificial 
memory region, determining an export table entry in the export table of the dynamically- 
linked library that is associated with the attempt to access the artificial memory region." 
Third, the proposed Chess-Nachenberg combination fails to disclose "determining based on 
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the export table entry associated with the attempt to access the artificial memory region that 
the emulated computer executable code is viral." As a result, the proposed Chess- 
Nachenberg combination fails to disclose, teach, or suggest every element of Claim 1, as 
discussed further below. 

i. "creating an artificial memory region spanning one or more components of the 
operating system, wherein the artificial memory region is associated wit h an export 
table of a dynamically-linked library" 

The proposed Chess-Nachenberg combination fails to disclose "creating an artificial 
memory region spanning one or more components of the operating system, wherein the 
artificial memory region is associated with an export table of a dynamically-linked library" as 
recited by Claim 1 . The Office Action concedes that Chess "fails to explicitly disclose the 
artificial memory region is associated with an export table of a dynamically-linked library." 
Office Action, p. 3. Moreover, the Office Action fails to address this element entirely with 
respect to Nachenberg. The Office Action fails to cite to any portion of Nachenberg that 
discloses "the artificial memory region is associated with an export table of a dynamically- 
linked library." As a result, the proposed Chess-Nachenberg combination fails to disclose 
"creating an artificial memory region spanning one or more components of the operating 
system, wherein the artificial memory region is associated with an export table of a 
dynamically-linked library " (emphasis added) as recited by Claim 1 . 

ii. "in response to detecting an attempt to access the artificial memory region, 
determining an export table entry in the export table of the dynamically-linked library 
that is associated with the attempt to access the artificial memory region" 

The proposed Chess-Nachenberg combination also fails to disclose "in response to 
detecting an attempt to access the artificial memory region, determining an export table entry 
in the export table of the dynamically-linked library that is associated with the attempt to 
access the artificial memory region" as recited by Claim 1. In rejecting Claim 1, the Office 
Action fails to address the language of this element entirely. Instead, the Office Action 
improperly paraphrases the wording of this element in describing the alleged teachings of 
both Chess and Nachenberg. Applicants note however that "[a]ll words in a claim must be 
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considered in judging the patentability of that claim against the prior art." M.P.E.P. § 
2143.03 (citing In re Wilson, 424 F.2d 1382, 165 U.S.P.Q. 494, 496 (C.C.P.A. 1970)). Thus, 
it is improper to paraphrase elements or omit claim terms for purposes of comparing the 
language of a claim to the teachings of cited art. 

With respect to Chess the Office Action asserts that "Chess discloses ... in response 
to detecting an attempt to access the artificial memory region, determining a source program 
that is associated with the attempt to access the artificial memory region." Office Action, pp. 
2-3, emphasis added. While Applicants do not necessarily agree with the Office Action's 
reading of Chess, Applicants note that this description erroneously paraphrases the language 
of Claim 1 . In particular, Claim 1 recites "in response to detecting an attempt to access the 
artificial memory region, determining an export table entry in the export table of the 
dynamically-linked library that is associated with the attempt to access the arti ficial memory 
region " (emphasis added). 

Additionally, the Office Action simply asserts that Nachenberg teaches "monitoring 
these entry points ... to determine whether a virus is present " Office Action, p. 4, emphasis 
added. While Applicants also do not necessarily agree with the Office Action's reading of 
Nachenberg, Applicants note that this description also erroneously paraphrases the language 
of Claim 1 . Again, Claim 1 recites "in response to detecting an attempt to access the artificial 
memory region, determining an export table entry in the export table of the dynamically- 
linked library that is associated with the attempt to access the artificial memory region " 
(emphasis added). 

Thus, the Office Action fails to address the language of Claim 1 itself and provides no 
citation to any reference allegedly teaching "in response to detecting an attempt to access the 
artificial memory region, determining an export table entry in the export table of the 
dynamically-linked library that is associated with the attempt to access the artificial memory 
region." Moreover, the proposed Chess-Nachenberg combination fails to disclose "in 
response to detecting an attempt to access the artificial memory region, determining an export 
table entry in the export table of the dynamically-linked library that is associated with the 
attempt to access the artificial memory region" as recited by Claim 1 . 
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iii. "determining based on the export table entry associated with the attempt to 
access the artificial memory region that the emulated computer executable code is viral" 

The proposed Chess-Nachenberg combination also fails to disclose "determining 
based on the export table entry associated with the attempt to access the artificial memory 
region that the emulated computer executable code is viral" as recited by Claim 1. In 
addressing the this element, the Office Action again erroneously paraphrases the language of 
Claim 1 . Specifically, the Office Action asserts simply that "Chess discloses . . . 
determining based on the attempt to access the artificial memory region that the emulated 
computer executable code is viral." Office Action, pp. 3-4, emphasis added. While 
Applicants also do not necessarily agree with the Office Action's interpretation of Chess, 
Applicants note that this description again erroneously paraphrases the language of Claim 1 . 
In particular, Claim 1 recites "determining based on the export table entry associate d with the 
attempt to access the artificial memory region that the emulated computer executable code is 
viral" (emphasis added). Thus, the Office Action fails to cite to any portion of Chess or 
Nachenberg that allegedly discloses "determining based on the export table entry associated 
with the attempt to access the artificial memory region that the emulated computer executable 
code is viral" as recited by Claim 1 , and the proposed Chess-Nachenberg combination fails to 
disclose this element. 

As a result, the proposed Chess-Nachenberg combination fails to disclose every 
element of Claim 1. Claim 1 is thus allowable for at least these reasons. Applicants 
respectfully request reconsideration and allowance of Claim 1 and its dependents. 

Although of differing scope from Claim 1, Claims 10-12 and 14 include elements 
that, for reasons substantially similar to those discussed with respect to Claim 1, are not 
disclosed by the proposed Chess-Nachenberg combination. Claims 10-12 and 14 are thus 
allowable for at least these reasons. Applicants respectfully request reconsideration and 
allowance of Claims 10-12 and 14, and their respective dependents. 
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Claim 21 was rejected under 35 U.S.C. § 103(a) as being unpatentable over Chess and 
Nachenberg as applied to Claim 1 and further in view of U.S. Patent No. 5,398,196 issued to 
Chambers ("Chambers"). Claim 21 depends from Claim 1, which has been shown above to 
be allowable. Claim 21 is thus allowable for at least this reason. Applicants respectfully 
request reconsideration and allowance of Claim 21 . 
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Conclusions 



Applicants have made an earnest attempt to place this case in condition for allowance. 
For the foregoing reasons, and for other reasons clearly apparent, Applicants respectfully 
request full allowance of all pending Claims. If the Examiner feels that a telephone 
conference or an interview would advance prosecution of this Application in any manner, the 
undersigned attorney for Applicants stands ready to conduct such a conference at the 
convenience of the Examiner. 

The Commissioner is hereby authorized to charge any required fee or to credit any 
overpayments to Deposit Account No. 02-0384 of Baker Botts L.L.P. 



Respectfully submitted, 



BAKER BOTTS L.L.P. 



Attorneys for Applicants 
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